[refactor] Code duplication findings (2026-05-20)

## Summary
- Files analyzed: 200
- Functions cataloged: ~4093
- Clusters with issues: 1

## Findings

### 1. Duplicate request-tracing setup across EntityAnalytics providers
**Occurrences:**
- `x-pack/filebeat/input/entityanalytics/provider/okta/okta.go:230-274` (`requestTrace`)
- `x-pack/filebeat/input/entityanalytics/provider/jamf/jamf.go:215-259` (`requestTrace`)
- `x-pack/filebeat/input/entityanalytics/provider/azuread/fetcher/graph/graph.go:555-599` (`requestTrace`)

**Similarity:**
All three functions implement the same tracer lifecycle and transport wiring flow:
- cleanup disabled traces via `os.Remove` and `filepath.Glob(base + "-" + lumberjackTimestamp + ext)`
- close tracer on context cancellation (`<-ctx.Done(); cfg.Tracer.Close()`)
- create zap logger and wrap transport with `httplog.NewLoggingRoundTripper(...)`

Representative matching code:
- `okta.go:245` and `jamf.go:230` and `graph.go:570`: `paths, err := filepath.Glob(base + "-" + lumberjackTimestamp + ext)`
- `okta.go:272` and `jamf.go:257` and `graph.go:597`: `cli.Transport = httplog.NewLoggingRoundTripper(cli.Transport, traceLogger, maxBodyLen, log)`

**What is wrong:**
Provider-independent HTTP tracer setup is implemented three times in separate provider packages instead of a shared helper.

**Why it matters:**
This code path controls request tracing behavior and log lifecycle. Duplication has already begun to drift (`graph.go:596` uses `max(1, cfg.Tracer.MaxSize) * 1e6 / 10` while the other two use `cfg.Tracer.MaxSize * 1e6 / 10`), which increases the chance of inconsistent behavior and repeated bug-fix work.

**Suggested fix:**
Extract a shared internal helper for tracer setup/cleanup (e.g., under `x-pack/filebeat/input/internal/httplog` or an EntityAnalytics shared package) that accepts the tracer config and logger, and have `okta`, `jamf`, and `azuread/fetcher/graph` call it.

## Suggested Actions
- [ ] Add one shared `requestTrace` helper for tracer cleanup + `httplog.NewLoggingRoundTripper` wiring.
- [ ] Replace provider-local implementations in `okta`, `jamf`, and `azuread/fetcher/graph` with thin adapters to the shared helper.
- [ ] Preserve current behavior by keeping existing error/log strings and adding package-level tests around `Tracer` enabled/disabled paths.

## Analysis Metadata
- Serena tools used: `activate_project`, `get_symbols_overview`, `find_symbol`, `search_for_pattern` (not available in this runtime; direct source inspection fallback used)
- Analysis date: 2026-05-20T13:11:44Z

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Code Duplication Detector](https://github.com/elastic/beats/actions/runs/26164612747)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on May 27, 2026, 1:22 PM UTC